Google Fonts指南

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:43 AM UTC
• Version: 1.0.1

Overview

This Google Fonts guide is mostly informational, but it asks for broad file and command abilities and includes unrelated automation and API instructions that should be reviewed before installation.

Install only if you are comfortable with the host agent ignoring or tightly constraining the declared write and exec powers. Prefer running it as a knowledge reference for Google Fonts advice, and require explicit confirmation before package installation, command execution, file writes, credential use, callbacks, or any non-font automation task.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:23

Finding

Excessive File and Command-Execution Capabilities

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:23-26
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml

tools:
- read
- exec
- write

Technical Analysis

The Skill declares unrestricted reading, writing, and command-execution tools even though its documented primary purpose is to provide Google Fonts selection, pairing, loading, subsetting, and self-hosting guidance.

General-purpose exec and write capabilities are not necessary for ordinary font recommendations or for generating example CSS and HTML. No path restrictions, command allowlist, sandbox policy, confirmation requirement, or prohibition against modifying unrelated files is defined.

Elsewhere, the document advertises generic file processing, API integration, and command execution and recommends elevated execution when permission errors occur. These instructions compound the least-privilege concern. However, the reviewed file contains no concrete malicious command or automatic privilege-escalation payload.

Attack Path

1. The Skill is loaded with read, write, and exec available.
2. An untrusted or overly broad task is supplied through the Skill's generic input interface.
3. The agent interprets the request as requiring file processing or shell execution.
4. Because the Skill defines no command allowlist or path boundary, the agent may access or modify files outside the legitimate font-processing scope.
5. If permission errors occur, the accompanying troubleshooting guidance may encourage elevated execution, increasing the potential impact.

Exploitation depends on the host agent granting the declared tools and acting on an unsafe request; the Markdown file does not independently execute commands.

Impact Assessment

If honored without additional platform controls, these declarations could permit:

• Reading files available to the agent ...[truncated 505 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec and write from the declared tool list when the Skill is used only as a font guidance knowledge base.
2. If font subsetting is required, expose a narrowly scoped operation rather than unrestricted shell access.
3. Restrict readable and writable paths to an explicit workspace or dedicated font directory.
4. Allowlist required executables and arguments, such as a validated invocation of pyftsubset.
5. Reject shell metacharacters and avoid passing user-controlled strings through a shell interpreter.
6. Require explicit user confirmation before modifying files, installing software, or invoking external commands.
7. Remove guidance recommending administrator execution. Document that the Skill should run as an unprivileged user.
8. Enforce operating-system sandboxing, resource limits, network restrictions, and auditable command logging at the host-agent level.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:170

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:170
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

bash

pip install fonttools

Technical Analysis

The installation instruction retrieves the latest version of fonttools resolved by the configured Python package index. It does not specify an audited version, lock dependencies, verify package hashes, or require an isolated environment.

Consequently, installation behavior may change after the Skill has been reviewed. A compromised future release, compromised package index, maliciously configured package mirror, or incompatible dependency update could introduce unreviewed code into the execution environment.

The package name shown is not an evident typo and the document does not direct users to a known malicious repository. Therefore, this is a supply-chain hardening weakness rather than evidence that the current dependency is malicious.

Attack Path

1. A user follows the documented setup instruction.
2. pip contacts its configured package index or mirror.
3. Because no version or hash is specified, the resolver selects the currently available compatible release.
4. If that release, a transitive dependency, or the configured mirror has been compromised, attacker-controlled package code may be installed.
5. The malicious code may execute during installation or when the font-subsetting utility is subsequently invoked.

Impact Assessment

A compromised package could run with the privileges of the user performing the installation. Potential impact includes:

• Reading or modifying files accessible to that user.
• Accessing environment variables and locally available credentials.
• Executing arbitrary commands.
• Altering generated font assets or project files.
• Making outbound network connections where network policy permits.

The reviewed project does not contain evidence that the named p ...[truncated 32 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin fonttools to a reviewed, compatible version.
2. Record transitive dependencies in a lockfile or fully pinned requirements file.
3. Require package hashes, for example through pip install --require-hashes.
4. Install the dependency in a dedicated virtual environment or disposable sandbox rather than globally.
5. Use a trusted, controlled package index and reject unapproved mirrors.
6. Periodically scan pinned dependencies for security advisories and update them through a reviewed process.
7. Avoid running package installation as an administrator or root user.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description uses broad invocation language such as efficiency improvement, automation, workflow optimization, marketing copy, and content creation, which are far wider than Google Fonts guidance. Overbroad triggers increase the likelihood that the agent activates this skill for unrelated prompts, potentially bringing along unjustified tools and instructions into higher-risk contexts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Declaring the exec capability for a font-selection and pairing guide is not justified by the core task and materially raises risk. In agent environments, unnecessary shell access expands the attack surface for command execution, local file access, dependency installation, or misuse triggered by ambiguous instructions in the skill text.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest markets the skill as a Google Fonts guide but its description broadens into generic efficiency, workflow automation, batch processing, and content-generation scenarios. That mismatch weakens principle-of-least-privilege expectations and can cause the skill to be selected outside its safe domain, where attached tools may be misused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description explicitly states "支持中文交互，无需复杂配置即开即用," and the skill metadata mixes Chinese naming and guidance without offering a language choice. This can violate language/locale policy when a skill defaults users into a specific language rather than letting them opt in or choose their preferred locale.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill claims broad capabilities such as file processing, API integration, command execution, and search even though the document otherwise presents itself as a Google Fonts guidance resource. This kind of scope inflation can cause an agent or user to invoke the skill in contexts involving filesystem, network, or shell actions that are unrelated to its stated purpose, increasing the chance of unsafe or unintended operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown advertises file writing, API integration, command execution, and related operational behaviors without prominent up-front warnings about system, network, or data impact. In a skill with ambiguous scope, this can lead users or agents to authorize side-effecting actions without understanding that the purportedly informational skill may touch files, commands, or external services.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The troubleshooting and quick-start sections describe API keys, authentication failures, command execution, permissions, and runtime workflows that contradict the skill's own classification as knowledge-only Markdown. These instructions normalize privileged or side-effecting actions and can mislead an agent into requesting credentials or performing shell operations that are unnecessary for a font-selection guide.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.